CVE-2026-85182
Received Received - Intake

Authenticated Password Change in vhr Application

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85182
EUVD
EUVD-2026-70486

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lenve vhr to 03abbd3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the vhr application through commit 03abbd3. It fails to verify if the account ID in a PUT request to /hr/pass belongs to the authenticated user. Attackers with valid credentials can change passwords of any account by providing the target account ID and its current password.

Impact Analysis

Authenticated attackers could gain unauthorized access to other users' accounts by changing their passwords. This could lead to data theft, unauthorized actions, or complete account takeover for affected users.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Update vhr to the latest commit or version that includes proper account ID verification in PUT /hr/pass requests. Ensure all authenticated requests validate that the account ID matches the caller's session.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85182. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart